CVE-2024-10160: Boat Booking System SQLi Vulnerability

CVE-2024-10160 Overview

CVE-2024-10160 is a SQL injection vulnerability in PHPGurukul Boat Booking System 1.0. The flaw resides in the /admin/bwdates-report-details.php file within the BW Dates Report Page component. Attackers can manipulate the fdate and tdate parameters to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely and requires low-privilege authentication. Public exploit details have been disclosed, increasing exposure risk for unpatched deployments. The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated remote attackers can extract, modify, or delete database contents through crafted fdate or tdate parameter values against the admin BW Dates Report page.

Affected Products

PHPGurukul Boat Booking System 1.0
Component: /admin/bwdates-report-details.php (BW Dates Report Page)
Vulnerable parameters: fdate and tdate

Discovery Timeline

2024-10-20 - CVE-2024-10160 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10160

Vulnerability Analysis

The vulnerability exists in the administrative reporting functionality of PHPGurukul Boat Booking System 1.0. The bwdates-report-details.php script accepts user-supplied date range values through the fdate (from date) and tdate (to date) HTTP parameters. These parameters are concatenated directly into SQL queries without proper sanitization or parameterized query usage.

An authenticated attacker with access to the admin panel can inject SQL fragments through either parameter. The initial researcher advisory identified only fdate as vulnerable, but analysis indicates tdate follows the same insecure query construction pattern. Successful exploitation grants read and write access to the underlying MySQL database.

Full technical details are available in the public GitHub advisory and VulDB entry #280946.

Root Cause

The root cause is improper neutralization of special SQL characters in user-controlled input [CWE-89]. The application constructs SQL queries by directly concatenating the fdate and tdate parameter values instead of using prepared statements or bound parameters. This design flaw allows quote characters and SQL keywords to break out of the intended query context.

Attack Vector

The attack requires network access to the administrative interface and valid low-privilege credentials. An attacker submits crafted HTTP requests to /admin/bwdates-report-details.php with malicious SQL payloads in the fdate or tdate parameters. The manipulated query executes with the privileges of the database user configured in the application.

Since PHPGurukul Boat Booking System is often deployed as a learning project or small-business application, database accounts frequently hold broad privileges. This amplifies the impact of successful injection.

No verified proof-of-concept code is republished here. Technical exploitation details are documented in the referenced GitHub SQL Injection Report.

Detection Methods for CVE-2024-10160

Indicators of Compromise

HTTP requests to /admin/bwdates-report-details.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment sequences (--, #) in the fdate or tdate parameters.
Unusual database error messages or 500 responses originating from the BW Dates Report page in web server logs.
Unexpected outbound queries or connections from the database host following administrative report requests.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the fdate and tdate parameters for SQL injection signatures on requests to the admin path.
Enable MySQL general query logging temporarily to identify malformed queries containing injected clauses against report tables.
Review application access logs for repeated failed admin logins followed by report page access, which may indicate credential-based exploitation attempts.

Monitoring Recommendations

Alert on any HTTP request to /admin/bwdates-report-details.php containing URL-encoded quotes (%27), boolean operators, or time-delay functions in date parameters.
Monitor database process lists for long-running or SLEEP()-based queries indicating blind SQL injection probing.
Track file integrity on the PHPGurukul webroot to detect webshell drops that may follow database compromise.

How to Mitigate CVE-2024-10160

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlisting or VPN-only access until a patch is applied.
Rotate all administrative credentials for the Boat Booking System and any accounts sharing passwords.
Audit the underlying MySQL database for unauthorized modifications, added users, or exfiltrated records.

Patch Information

As of the last NVD update, PHPGurukul has not published a dedicated security advisory or patched release addressing CVE-2024-10160. Monitor the PHP Gurukul website for future updates. Organizations should evaluate whether continued use of this application is appropriate given the absence of a vendor fix.

Workarounds

Apply a virtual patch via WAF rules that reject requests to /admin/bwdates-report-details.php when fdate or tdate parameters contain non-date characters. Enforce a strict YYYY-MM-DD regex pattern.
Modify the vulnerable PHP source to use mysqli_prepare() with bound parameters, replacing string concatenation in the report query construction.
Reduce database privileges for the application account to SELECT only on required tables, limiting the impact of successful injection.

bash

# Example WAF regex to enforce YYYY-MM-DD format on date parameters
# ModSecurity rule (illustrative)
SecRule ARGS:fdate|ARGS:tdate "!@rx ^\d{4}-\d{2}-\d{2}$" \
    "id:1010160,phase:2,deny,status:400,\
     msg:'CVE-2024-10160: Invalid date parameter format'"